PHP - Does PDO quote safe from SQL Injection?

前端 未结 3 1451
北恋
北恋 2020-12-16 05:01
$id  = trim((int)$_GET[\'id\']);
$sql = \'SELECT * FROM users WHERE id = \' . $db->quote($id) . \' LIMIT 1\';
$run = $db->query($sql)->fetch();
3条回答
  •  被撕碎了的回忆
    2020-12-16 05:28

    What is the point of using trim on int. And then quoting that value? Since you have integer value then use it as such

    $sql = 'SELECT * FROM users where id = ' . $id . ' LIMIT 1';
    

    Instead of blindly quote everything just mind the types of your variables and make sure you are not doing stupid things like $id = trim((int)$_GET['id']); where $id = (int)$_GET['id']; would be more than enough

    If you are not sure you can make it, use prepared statements. But please mind what you are coding

提交回复
热议问题